I don't think you will find a document that states using AD over an internal account is a best practice. It really depends on your environment. The benefit of using AD over internal is that you only have one identity store where all accounts are stored and one place for their passwords. You can also use the existing groups within AD for RBAC instead of having to create that within ISE. When users have accounts/passwords in multiple systems, it becomes more difficult to remember all of the passwords, especially when there is a requirement to change the passwords regularly (i.e. every 90 days). So you end up in a situation where users will write passwords down, or just get frustrated having to reset forgotten passwords all of the time. You can still use local accounts in ISE as a backup, in case AD is down or the connection between ISE and AD is not working. Hope that helps.
